Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 10:25

General

  • Target

    ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe

  • Size

    625KB

  • MD5

    d0b364f822671f87eb9d4770e11ecb14

  • SHA1

    bafe475014d7e6f2e9cc6cbbcad91f3096d8e5f4

  • SHA256

    ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd

  • SHA512

    4f3ccbbd81f09903f42a5966114c80c971cb3066d319b3238fb5ea6ecc690a728ae8207a8f6772b6ebca5ad8789178eda29a818c8bdbde7e4d8cc8eaa14c8f85

  • SSDEEP

    12288:hg+gjjwmSK3ALgXgxvFDyfD1XBxzHMT0jZOJk7j4epPfArQyX0kZ2GEV4gB4IjY3:CjjwS3UW0NKhXLNjZzTPIrQu0kZCV4gS

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe
    "C:\Users\Admin\AppData\Local\Temp\ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\n7347\s7347.exe
      "C:\Users\Admin\AppData\Local\Temp\n7347\s7347.exe" 1d68d7d720be5c195a286c56G1mzhs/RIyfpCNjUJN4MP9Scsl2FEjqnyB9VUtdk4bDi5GiAzK3dS/sDj1fVG6Q3ee42xTsZDAo3GOapd0Tr0V2SDAlWXHwEusQJn4CT0wYplNd731cVktFazKLXoJztv4ScQAfD3P5nVXlIJ3obb5mEPcl00PKi6GgfT1s= /v "C:\Users\Admin\AppData\Local\Temp\ebc2b3a32ab09a4f08fe3d0dbdd2022cfaf88abcfb48436613af27ece6bc9ffd.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2232

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n7347\s7347.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • C:\Users\Admin\AppData\Local\Temp\n7347\s7347.exe

    Filesize

    350KB

    MD5

    54394ba7de5b2c5e3df92557ea95f014

    SHA1

    47a99735e089139495643c9027effcb6b1fc5504

    SHA256

    339f7dd54a1e07bfcabb5749047ef4ab615462213f5baaa62fb690c894bef1eb

    SHA512

    45928ffec4f1bf9a86469bb54f83ba6fdcd275ef9826bd923e890fce83d7a8f975c309bda4849d3f2d066ea458f23fa8e6aefe26be5e874249712462ecd69660

  • memory/2232-135-0x00007FFA787C0000-0x00007FFA791F6000-memory.dmp

    Filesize

    10.2MB

  • memory/2232-136-0x0000000000D4A000-0x0000000000D4F000-memory.dmp

    Filesize

    20KB

  • memory/2232-137-0x0000000000D4A000-0x0000000000D4F000-memory.dmp

    Filesize

    20KB

  • memory/2232-138-0x0000000000D4A000-0x0000000000D4F000-memory.dmp

    Filesize

    20KB